Bug 708405. Make sure to propagate out failures from JS_HasPropertyById in the old nodelist resolve hook. r=mrbkap

2011-12-15 14:36:46 -05:00 · 2011-12-15 14:36:46 -05:00 · 7a2a7b979b
--- a/dom/base/crashtests/708405-1.html
+++ b/dom/base/crashtests/708405-1.html
@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.getElementsByTagName("div");
+  a.__proto__ = Proxy.create({has: function() { throw new Error; }});
+  for (var p in a) {
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -33,3 +33,4 @@ load 693894.html
 load 695867.html
 load 697643.html
 load 706283-1.html
+load 708405-1.html
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -7974,12 +7974,19 @@ nsNamedArraySH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
      }

      JSObject *proto = ::JS_GetPrototype(cx, realObj);
-      JSBool hasProp;

-      if (proto && ::JS_HasPropertyById(cx, proto, id, &hasProp) && hasProp) {
-        // We found the property we're resolving on the prototype,
-        // nothing left to do here then.
-        return NS_OK;
+      if (proto) {
+        JSBool hasProp;
+        if (!::JS_HasPropertyById(cx, proto, id, &hasProp)) {
+          *_retval = false;
+          return NS_ERROR_FAILURE;
+        }
+
+        if (hasProp) {
+          // We found the property we're resolving on the prototype,
+          // nothing left to do here then.
+          return NS_OK;
+        }
      }
    }